[GH-ISSUE #4952] macOS: Netbird adds DNS search domain to Wi-Fi resolver #10423

Closed
opened 2026-08-05 01:25:52 -04:00 by saavagebueno · 2 comments
Owner

Originally created by @JannikWortmann on GitHub (Dec 15, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/4952

Describe the problem
Netbird adds the netbird.cloud domain to the search domains of the Wi-Fi resolver(resolver#1). This causes macOS to not be able to resolve domains like mypeer.netbird.cloud since it consults the first resolver instead of the actual resolver#2 which correctly routes the request to the netbird nameserver.

Clean restart without netbird running (scutil --dns):

resolver #1
  search domain[0] : fritz.box
  nameserver[0] : 192.168.178.1
  nameserver[1] : <redacted>
  nameserver[2] : <redacted>
  if_index : 12 (en0)
  flags    : Request A records, Request AAAA records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

After enabling netbird:

resolver #1
  search domain[0] : netbird.cloud
  search domain[1] : fritz.box
  nameserver[0] : 192.168.178.1
  nameserver[1] : <redacted>
  nameserver[2] : <redacted>
  if_index : 12 (en0)
  flags    : Request A records, Request AAAA records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

resolver #2
  domain   : netbird.cloud
  nameserver[0] : 100.120.255.254
  port     : 53
  flags    : Supplemental, Request A records, Request AAAA records
  reach    : 0x00000002 (Reachable)
  order    : 103000

To Reproduce

Steps to reproduce the behavior:

  1. Enable Netbird and connect. It already adds the incorrect search domain to the Wi-Fi interface.

Expected behavior

Not add the search domain to the Wi-Fi resolver.

Are you using NetBird Cloud?

Yes

NetBird version

netbird version v0.60.7

Is any other VPN software installed?

Yes, Proton VPN. Not running. Also no interfaces nor DNS resolvers are present.

Debug output

To help us resolve the problem, please attach the following anonymized status output

netbird status -dA

Peers detail:
 <redacted>.netbird.cloud:
  NetBird IP: 100.120.62.185
  Public key: <redacted>
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 9 minutes, 3 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 <redacted>.netbird.cloud:
  NetBird IP: 100.120.220.142
  Public key: <redacted>
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address:
  Last connection update: 9 minutes, 3 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

Events:
  [INFO] SYSTEM (<redacted>)
    Message: Network map updated
    Time: 9 minutes, 3 seconds ago
OS: darwin/arm64
Daemon version: 0.60.7
CLI version: 0.60.7
Profile: default
Management: Connected to https://api.netbird.io:443
Signal: Connected to https://signal.netbird.io:443
Relays:
  [stun:stun.netbird.io:443] is Available
  [stun:stun.netbird.io:5555] is Available
  [turns:turn.netbird.io:443?transport=tcp] is Available
  [rels://streamline-de-fra1-2.relay.netbird.io:443] is Available
Nameservers:
FQDN: <redacted>.netbird.cloud
NetBird IP: 100.120.62.132/16
Interface type: Userspace
Quantum resistance: false
Lazy connection: false
SSH Server: Disabled
Networks: -
Forwarding rules: 0
Peers count: 0/2 Connected

Create and upload a debug bundle, and share the returned file key:

netbird debug for 1m -AS -U

f79e391890ab27fb37c88b3b4be7011e22aa2e5ca6f38ffa9c4481884941f726/fda18de4-75bb-46fa-ba6c-678bd079eb45

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @JannikWortmann on GitHub (Dec 15, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/4952 **Describe the problem** Netbird adds the `netbird.cloud` domain to the search domains of the Wi-Fi resolver(resolver#1). This causes macOS to not be able to resolve domains like `mypeer.netbird.cloud` since it consults the first resolver instead of the actual resolver#2 which correctly routes the request to the netbird nameserver. Clean restart without netbird running (scutil --dns): ``` resolver #1 search domain[0] : fritz.box nameserver[0] : 192.168.178.1 nameserver[1] : <redacted> nameserver[2] : <redacted> if_index : 12 (en0) flags : Request A records, Request AAAA records reach : 0x00020002 (Reachable,Directly Reachable Address) ``` **After** enabling netbird: ``` resolver #1 search domain[0] : netbird.cloud search domain[1] : fritz.box nameserver[0] : 192.168.178.1 nameserver[1] : <redacted> nameserver[2] : <redacted> if_index : 12 (en0) flags : Request A records, Request AAAA records reach : 0x00020002 (Reachable,Directly Reachable Address) resolver #2 domain : netbird.cloud nameserver[0] : 100.120.255.254 port : 53 flags : Supplemental, Request A records, Request AAAA records reach : 0x00000002 (Reachable) order : 103000 ``` **To Reproduce** Steps to reproduce the behavior: 1. Enable Netbird and connect. It already adds the incorrect search domain to the Wi-Fi interface. **Expected behavior** Not add the search domain to the Wi-Fi resolver. **Are you using NetBird Cloud?** Yes **NetBird version** `netbird version v0.60.7` **Is any other VPN software installed?** Yes, Proton VPN. Not running. Also no interfaces nor DNS resolvers are present. **Debug output** To help us resolve the problem, please attach the following anonymized status output netbird status -dA ``` Peers detail: <redacted>.netbird.cloud: NetBird IP: 100.120.62.185 Public key: <redacted> Status: Connecting -- detail -- Connection type: - ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 9 minutes, 3 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s <redacted>.netbird.cloud: NetBird IP: 100.120.220.142 Public key: <redacted> Status: Connecting -- detail -- Connection type: - ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 9 minutes, 3 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s Events: [INFO] SYSTEM (<redacted>) Message: Network map updated Time: 9 minutes, 3 seconds ago OS: darwin/arm64 Daemon version: 0.60.7 CLI version: 0.60.7 Profile: default Management: Connected to https://api.netbird.io:443 Signal: Connected to https://signal.netbird.io:443 Relays: [stun:stun.netbird.io:443] is Available [stun:stun.netbird.io:5555] is Available [turns:turn.netbird.io:443?transport=tcp] is Available [rels://streamline-de-fra1-2.relay.netbird.io:443] is Available Nameservers: FQDN: <redacted>.netbird.cloud NetBird IP: 100.120.62.132/16 Interface type: Userspace Quantum resistance: false Lazy connection: false SSH Server: Disabled Networks: - Forwarding rules: 0 Peers count: 0/2 Connected ``` Create and upload a debug bundle, and share the returned file key: netbird debug for 1m -AS -U `f79e391890ab27fb37c88b3b4be7011e22aa2e5ca6f38ffa9c4481884941f726/fda18de4-75bb-46fa-ba6c-678bd079eb45` **Have you tried these troubleshooting steps?** - [X] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [X] Checked for newer NetBird versions - [X] Searched for similar issues on GitHub (including closed ones) - [X] Restarted the NetBird client - [X] Disabled other VPN software - [ ] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:25:52 -04:00
Author
Owner

@Tobi3030 commented on GitHub (Dec 22, 2025):

I have noticed the same problem when using a DNS over HTTPS - configuration profile on my mac.

With the configuration profile disabled, Netbird DNS works as expected and scutil --dns looks like this:

resolver #1
  search domain[0] : netbird.cloud
  search domain[1] : fritz.box
  nameserver[0] : 100.127.255.254
  port     : 53
  flags    : Supplemental, Request A records
  reach    : 0x00000002 (Reachable)
  order    : 101600

But when I enable the DNS over HTTPS - configuration profile, Netbird does not change the nameserver of resolver #1 and therefore the Netbird nameserver is not used anymore:

resolver #1
  search domain[0] : netbird.cloud
  search domain[1] : fritz.box
  nameserver[0] : 192.168.10.1
  if_index : 14 (en0)
  flags    : Request A records
  reach    : 0x00020002 (Reachable,Directly Reachable Address)

I'm using the same DoH - configuration profile on my iPhone, but everything works as expected there:
As soon as I connect to Netbird, the DNS server specified in Netbird is used and when I disconnect from Netbird the DoH server specified in my configuration profile is used again.

<!-- gh-comment-id:3682121556 --> @Tobi3030 commented on GitHub (Dec 22, 2025): I have noticed the same problem when using a DNS over HTTPS - configuration profile on my mac. With the configuration profile disabled, Netbird DNS works as expected and `scutil --dns` looks like this: ``` resolver #1 search domain[0] : netbird.cloud search domain[1] : fritz.box nameserver[0] : 100.127.255.254 port : 53 flags : Supplemental, Request A records reach : 0x00000002 (Reachable) order : 101600 ``` But when I enable the DNS over HTTPS - configuration profile, Netbird does not change the nameserver of `resolver #1` and therefore the Netbird nameserver is not used anymore: ``` resolver #1 search domain[0] : netbird.cloud search domain[1] : fritz.box nameserver[0] : 192.168.10.1 if_index : 14 (en0) flags : Request A records reach : 0x00020002 (Reachable,Directly Reachable Address) ``` I'm using the same DoH - configuration profile on my iPhone, but everything works as expected there: As soon as I connect to Netbird, the DNS server specified in Netbird is used and when I disconnect from Netbird the DoH server specified in my configuration profile is used again.
Author
Owner

@JannikWortmann commented on GitHub (Jan 10, 2026):

That was the issue! After removing the DoH profile on macOS, it can resolve the hostname correctly. Thank you!

<!-- gh-comment-id:3733365422 --> @JannikWortmann commented on GitHub (Jan 10, 2026): That was the issue! After removing the DoH profile on macOS, it can resolve the hostname correctly. Thank you!
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#10423